Identifying the license information for components used in Liferay DXP
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
legacy-article
learn-legacy-article-disclaimer-text
Issue
- I need to know the license information for components used in Liferay DXP.
- My security scan tool is flagging Liferay components with license not found errors.
Resolution
- Liferay can provide an SBOM (Software Bill of Materials) in SPDX JSON format that contains license information for Liferay components.
- The SBOM was created using ScanCode.io, specifically its map-deploy-to-develop pipeline, for which Liferay Portal/DXP was the codebase it was prototyped and originally developed for. As such, ScanCode.io is a tool selected and developed specifically with the goal to be the most correct state-of-the-art SCA of Liferay DXP.
Please feel free to review ScanCode.io's public and openly license source code, documentation, even the underlying data for ScanCode.io for more info.
- License texts and references between the packages/files and their respective licenses, as well as origin (downloadLocation), are also included in the SPDX SBOM (full specification).
- Our team is currently working on the SPDX SBOM file for every available Liferay DXP version in the future as a self-service feature, but there is no timeline for when this feature will be available and released to the public. Please open a Support ticket to request a SBOM for your Liferay DXP version.
did-this-article-resolve-your-issue